diff options
| -rw-r--r-- | cloudinit/CloudConfig.py | 59 | ||||
| -rw-r--r-- | doc/examples/cloud-config-puppet.txt | 51 | ||||
| -rw-r--r-- | upstart/cloud-config-puppet.conf | 12 |
3 files changed, 122 insertions, 0 deletions
diff --git a/cloudinit/CloudConfig.py b/cloudinit/CloudConfig.py index f4a6ef37..fbca1c0e 100644 --- a/cloudinit/CloudConfig.py +++ b/cloudinit/CloudConfig.py @@ -19,6 +19,8 @@ import yaml import re import cloudinit import cloudinit.util as util +import pwd +import socket import subprocess import os import glob @@ -40,6 +42,7 @@ class CloudConfig(): self.add_handler('disable-ec2-metadata', self.h_disable_ec2_metadata, "always") self.add_handler('config-mounts') + self.add_handler('config-puppet') def get_config_obj(self,cfgfile): f=file(cfgfile) @@ -181,6 +184,62 @@ class CloudConfig(): send_ssh_keys_to_console() + def h_config_puppet(self,name,args): + # Check if there is a puppet key in the configuration + if self.cfg.has_key('puppet'): + puppet_cfg = self.cfg['puppet'] + # Start by installing the puppet package ... + e=os.environ.copy() + e['DEBIAN_FRONTEND']='noninteractive' + # Make sure that the apt database is updated since it's not run by + # default + # Note: we should have a helper to check if apt-get update + # has already been run on this instance to speed the boot time. + subprocess.check_call(['apt-get', 'update'], env=e) + subprocess.check_call(['apt-get', 'install', '--assume-yes', + 'puppet'], env=e) + # ... and then update the puppet configuration + if puppet_cfg.has_key('conf'): + # Add all sections from the conf object to puppet.conf + puppet_conf_fh = open('/etc/puppet/puppet.conf', 'a') + for cfg_name, cfg in puppet_cfg['conf'].iteritems(): + # ca_cert configuration is a special case + # Dump the puppetmaster ca certificate in the correct place + if cfg_name == 'ca_cert': + # Puppet ssl sub-directory isn't created yet + # Create it with the proper permissions and ownership + os.makedirs('/var/lib/puppet/ssl') + os.chmod('/var/lib/puppet/ssl', 0771) + os.chown('/var/lib/puppet/ssl', + pwd.getpwnam('puppet').pw_uid, 0) + os.makedirs('/var/lib/puppet/ssl/certs/') + os.chown('/var/lib/puppet/ssl/certs/', + pwd.getpwnam('puppet').pw_uid, 0) + ca_fh = open('/var/lib/puppet/ssl/certs/ca.pem', 'w') + ca_fh.write(cfg) + ca_fh.close() + os.chown('/var/lib/puppet/ssl/certs/ca.pem', + pwd.getpwnam('puppet').pw_uid, 0) + else: + puppet_conf_fh.write("\n[%s]\n" % (cfg_name)) + for o, v in cfg.iteritems(): + if o == 'certname': + # Expand %f as the fqdn + v = v.replace("%f", socket.getfqdn()) + # Expand %i as the instance id + v = v.replace("%i", + self.cloud.datasource.get_instance_id()) + # certname needs to be downcase + v = v.lower() + puppet_conf_fh.write("%s=\"%s\"\n" % (o, v)) + puppet_conf_fh.close() + # Set puppet default file to automatically start + subprocess.check_call(['sed', '-i', + '-e', 's/^START=.*/START=yes/', + '/etc/default/puppet']) + # Start puppetd + subprocess.check_call(['service', 'puppet', 'start']) + def h_ec2_ebs_mounts(self,name,args): print "Warning, not doing anything for config %s" % name diff --git a/doc/examples/cloud-config-puppet.txt b/doc/examples/cloud-config-puppet.txt new file mode 100644 index 00000000..258418a4 --- /dev/null +++ b/doc/examples/cloud-config-puppet.txt @@ -0,0 +1,51 @@ +#cloud-config +# +# This is an example file to automatically setup and run puppetd +# when the instance boots for the first time. +# Make sure that this file is valid yaml before starting instances. +# It should be passed as user-data when starting the instance. +puppet: + # Every key present in the conf object will be added to puppet.conf: + # [name] + # subkey=value + # + # For example the configuration below will have the following section + # added to puppet.conf: + # [puppetd] + # server=puppetmaster.example.org + # certname=i-0123456.ip-X-Y-Z.cloud.internal + # + # The puppmaster ca certificate will be available in + # /var/lib/puppet/ssl/certs/ca.pem + conf: + puppetd: + server: "puppetmaster.example.org" + # certname supports substitutions at runtime: + # %i: instanceid + # Example: i-0123456 + # %f: fqdn of the machine + # Example: ip-X-Y-Z.cloud.internal + # + # NB: the certname will automatically be lowercased as required by puppet + certname: "%i.%f" + # ca_cert is a special case. It won't be added to puppet.conf. + # It holds the puppetmaster certificate in pem format. + # It should be a multi-line string (using the | yaml notation for + # multi-line strings). + # The puppetmaster certificate is located in + # /var/lib/puppet/ssl/ca/ca_crt.pem on the puppetmaster host. + # + ca_cert: | + -----BEGIN CERTIFICATE----- + MIICCTCCAXKgAwIBAgIBATANBgkqhkiG9w0BAQUFADANMQswCQYDVQQDDAJjYTAe + Fw0xMDAyMTUxNzI5MjFaFw0xNTAyMTQxNzI5MjFaMA0xCzAJBgNVBAMMAmNhMIGf + MA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCu7Q40sm47/E1Pf+r8AYb/V/FWGPgc + b014OmNoX7dgCxTDvps/h8Vw555PdAFsW5+QhsGr31IJNI3kSYprFQcYf7A8tNWu + 1MASW2CfaEiOEi9F1R3R4Qlz4ix+iNoHiUDTjazw/tZwEdxaQXQVLwgTGRwVa+aA + qbutJKi93MILLwIDAQABo3kwdzA4BglghkgBhvhCAQ0EKxYpUHVwcGV0IFJ1Ynkv + T3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwDwYDVR0TAQH/BAUwAwEB/zAd + BgNVHQ4EFgQUu4+jHB+GYE5Vxo+ol1OAhevspjAwCwYDVR0PBAQDAgEGMA0GCSqG + SIb3DQEBBQUAA4GBAH/rxlUIjwNb3n7TXJcDJ6MMHUlwjr03BDJXKb34Ulndkpaf + +GAlzPXWa7bO908M9I8RnPfvtKnteLbvgTK+h+zX1XCty+S2EQWk29i2AdoqOTxb + hppiGMp0tT5Havu4aceCXiy2crVcudj3NFciy8X66SoECemW9UYDCb9T5D0d + -----END CERTIFICATE----- diff --git a/upstart/cloud-config-puppet.conf b/upstart/cloud-config-puppet.conf new file mode 100644 index 00000000..83786118 --- /dev/null +++ b/upstart/cloud-config-puppet.conf @@ -0,0 +1,12 @@ +# Setup puppetd + +description "Setup puppetd" + +# Make sure puppet is started after repositories have been setup. +# This can be useful if the puppet package should be pulled from +# a different repository. +start on started cloud-apt-update-upgrade +console output +task + +exec cloud-init-cfg config-puppet |